- dovecot - dovecot.org

Re: pop 110/995, imap 143/993 ?
by Robert Wolf 22 Aug '17

22 Aug '17

On Tue, 22 Aug 2017, Ivan Warren wrote: > Le 8/22/2017 à 10:03 AM, Robert Wolf a écrit : > > > > WRONG!!! The email is stored plain-text on the first server and then it can > > be > > sent to other few MX servers over plain-text connection. I.e. encrypted > > connection does not protect emails, but the authentication credentials. > > > > > Indeed. > > Encrypted (SSL/TLS) SMTP/IMAP/POP3 sessions only server 1 purpose : To encrypt > authentication. Once a message is sent through a MTA, there is no guarantee of > privacy whatsoever. > > End to End privacy can only be achieved through actual e-mail signing and > encryption (PGP, S/MIME) (but only the message body is encrypted, not the > headers). Hello Ivan yes, headers are not encrypted in plain-text SMTP, the same way as TCP and IP and DNS Requests are not encrypted. One can only hide behind some anonymization system (TOR, Proxy, VPN for TCP, IP, DNS) or some non-presonal mail system to anonymize mail headers to not be able to connect real persones with mail sender/recipient. Regards, Robert.

1 0

Re: pop 110/995, imap 143/993 ?
by Joseph Tam 22 Aug '17

22 Aug '17

Gary <lists(a)lazygranch.com> writes: > If I read this correctly, starttls will fail due to the MITM attack. > That is the client knows security has been compromised. I'm not sure what you man by "fail". STARTTLS is prone to MITM attacks if a client has not been configured to refuse non-STARTTLS/SSL sessions. For clients that will allow both secured and plaintext session (like most MTAs), an attacker can strip out the server's STARTTLS capability declaration and fool the client into using an unencrypted session. > Using SSL/TLS, the MITM can use SSL stripping. Since most Postifx conf > use "may" for security, the message would go though unencrypted. > Correct??? If it's what I described above, then yes. > Is there something to enable for perfect forward security with starttls? PFS is enabled using a particular choice of encryption algorithms (in particular, use of ephememeral keys algorithms like ECDHE-*), but this happens after SSL initiaton, whether by STARTTLS, or by connection to SSL ports. Joseph Tam <jtam.home(a)gmail.com>

1 0

Domain without certificate
by Andreas Meyer 22 Aug '17

22 Aug '17

Hello! I have a new domain integrated into dovecot but no certificate yet. In dovecot.conf there is ssl = yes and the other domains have certificates configured. How do I exclude this new domain from using SSL? Greetings Andreas

1 1

pop 110/995, imap 143/993 ?
by voytek＠sbt.net.au 21 Aug '17

21 Aug '17

just setting a new Dovecot server to migrate from older system, but, I have a general question: 1. I've set the server with self issued cert, and both pop/imap StartTLS/110/143 SSL/993/995 (apologies if I'm using wrong naming terminology) is there a 'preferred way'? should I tell users to use 143 over 993 ? or 993 over 143? or? my current understanding is that some (MS?) clients might not support StartTLS/143 ? so best to offer both ? I think? some public WiFi block 993/995 but allow 143/110, hence, another advantage for using 143/110 thanks for any advice, V

6 11

Permission denied to access the email file
by ATHANASE Jean-René 21 Aug '17

21 Aug '17

Hi, Dovecot version : 2.2.22 (fe789d2) Operating system : DISTRIB_ID=Ubuntu DISTRIB_RELEASE=16.04 DISTRIB_CODENAME=xenial DISTRIB_DESCRIPTION="Ubuntu 16.04.2 LTS" CPU architecture : Linux 4.4.67-1-pve #1 SMP PVE 4.4.67-92 (Fri, 23 Jun 2017 08:22:06 +0200) x86_64 GNU/Linux FIle system : local UID GID Aug 17 11:47:28 azizee dovecot: imap(jra11[*5063*:*5011*]): Debug: Effective uid=5063, gid=5011, home=/var/spool/domaines/vitalnet/jra/ Aug 17 11:47:28 azizee dovecot: imap(jra11[5063:5011]): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/var/spool/domaines/vitalnet/jra/ Aug 17 11:47:28 azizee dovecot: imap(jra11[5063:5011]): Debug: maildir++: root=/var/spool/domaines/vitalnet/jra, index=, indexpvt=, control=, inbox=/var/spool/domaines/vitalnet/jra, alt= Aug 17 11:47:28 azizee dovecot: imap(jra11[5063:5011]): *Error*: open(/var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee:2,) failed: *Permission denied* (euid=*5063*(<unknown>) egid=*5011*(<unknown>) missing +r perm: /var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee:2,) Ldap configuration : user_attrs = uid=user,userPassword=password,homeDirectory=home,uidNumber=uid,gidNumber=gid ll /var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee\:2\, -rw------- 1 5095 5011 438 Aug 16 15:29 /var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee:2, If I set with the command line "chmod g=rw /var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee\:2\,", this file email is treated by Dovecot, per example, i have deleted it. ll /var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee\:2\,ST -rw-rw---- 1 5095 5011 438 Aug 16 15:29 /var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee:2,ST What's the problem of my configuration ? Best regards,

2 1

ot: self certified enduser browser/mail client install?
by voytek＠sbt.net.au 21 Aug '17

21 Aug '17

I have self certified Dovecot as so: ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } in order for end user to avoid webmail warnings or email client warnings, do I make this file /etc/pki/dovecot/certs/dovecot.pem available to users say under httpd://webhost/tld/certificate/dovecot.pem and, tell users to import dovecot.pem (from /etc/pki/dovecot/certs/dovecot.pem) into their PC/browser/mailclient certs? (sorry for dumb Q, but I thought I should ask before I commit some fundamental stuffup)

3 2

Re: is a self signed certificate always invalid the first time
by Joseph Tam 21 Aug '17

21 Aug '17

Michael Felt <michael(a)felt.demon.nl> writes: >> I use acme.sh for all of my LetsEncrypt certs (web & mail), it is >> written in pure shell script, so no python dependencies. >> https://github.com/Neilpang/acme.sh > > Thanks - I might look at that, but as Ralph mentions in his reply - > Let's encrypt certs are only for three months - never ending circus. I wouldn't characterize it as a circus. Once you bootstrap your first certificate and install the cert-renew cron script, it's not something you have to pay a lot of attention to. I have a few LE certs in use, and I don't think about it anymore: it just works. The shorter cert lifetime also helps limit damage if your certificate gets compromised. Joseph Tam <jtam.home(a)gmail.com>

10 14

\Noselect isn't set on namespace prefix mailbox that can't be selected
by David Mandelberg 19 Aug '17

19 Aug '17

Hi, I tried using Nextcloud's Mail app to access my dovecot server (version: 2.2.27 (c0f36b0)), and got an error. The relevant imap log is: C: 3 LIST () "" (*) RETURN (SPECIAL-USE) ... S: * LIST () "/" Archives ... C: 6 STATUS Archives (MESSAGES) S: 6 NO Mailbox isn't selectable (0.000 + 0.000 secs). >> Command 6 took 0.0014 seconds. C: 7 LOGOUT S: * BYE Logging out S: 7 OK Logout completed (0.000 + 0.000 secs). >> Command 7 took 0.0021 seconds. And the relevant part of my dovecot config: namespace archives { disabled = no hidden = no ignore_on_failure = no inbox = no list = yes location = mbox:~/.mbox-archives order = 0 prefix = Archives/ separator = / subscriptions = yes type = private } Since ~/.mbox-archives is a directory, not a regular file, I'd expect dovecot to set the \Noselect attribute on the Archives folder. Is there something I'm missing? I tried using special_use, but that didn't accept \Noselect as an option.

1 0

Re: Dovecot mail_location for fedora
by Joseph Tam 19 Aug '17

19 Aug '17

>> mail_location=~/.mail:INBOX=/var/spool/mail/%Ln > > He should be good now, no idea why a fedora install wouldn't have that Unless I missed something in a previous pst, "~/.mail" is not typical for personal mail folder, but "~/mail" is. Joseph Tam <jtam.home(a)gmail.com>

2 1

Inconsistency in map index
by Webert de Souza Lima 18 Aug '17

18 Aug '17

Hello, The following errors are constantly popping up for 2 accounts. I can't get it fixed, I did doveadm backup to another account, the same happens in the new account. I did doveadm force-resync, the problem persists. I'm using dovecot 2.2. 2017-08-18T11:46:12.472821881Z Aug 18 11:46:12 lmtp(ramon.lacerda(a)alliar.com): Warning: mdbox /srv/dovecot2/mail/alliar.com/ramon.lacerda/storage: Inconsistency in map index (647,6288 != 647,28333584) 2017-08-18T11:46:12.651002372Z Aug 18 11:46:12 lmtp(ramon.lacerda(a)alliar.com): Warning: mdbox /srv/dovecot2/mail/alliar.com/ramon.lacerda/storage: Inconsistency in map index (647,6288 != 647,28333708) 2017-08-18T11:46:12.651059432Z Aug 18 11:46:12 lmtp(ramon.lacerda(a)alliar.com): Warning: fscking index file /srv/dovecot2/index/ alliar.com/ramon.lacerda/storage/dovecot.map.index 2017-08-18T11:46:12.764926940Z Aug 18 11:46:12 lmtp(ramon.lacerda(a)alliar.com): Warning: mdbox /srv/dovecot2/mail/alliar.com/ramon.lacerda/storage: rebuilding indexes Regards, Webert Lima DevOps Engineer at MAV Tecnologia *Belo Horizonte - Brasil*

3 5